TL;DR: Logical operations live in the set of operators $U_L\oplus U_N$ where $U_L$ acts on the code subspace and $U_N$ acts on its orthogonal complement. For a fixed logical operation $M$ there are many operators on the Hilbert space of the underlying $n$ physical qubits that realize $M$ within the code subspace. There is a subgroup $\mathcal{A}$ of the centralizer $C_{U(2^n)}(S)$ of $S$ in $U(2^n)$ which is isomorphic to the set of logical operations. Finally, logical operations do have realizations that live outside $\mathcal{A}$ and even outside of the normalizer $N_{U(2^n)}(S)$ of $S$ in $U(2^n)$. Below, we exhibit an example of such a realization for the three qubit repetition code.
Denote with $\mathcal{L}(S)$ the set of logical operations in an $[\![n, k]\!]$ code with the stabilizer group $S$. In other words, $M\in\mathcal{L}(S)$ if and only if
$$
\forall |\psi\rangle \in C(S) \,\, M|\psi \rangle \in C(S)
$$
as defined in the question. Recall that $n$ is the number of physical qubits and $k$ the number of logical qubits.
Characterization of operators preserving code subspace
Denote with $\mathcal{H}$ the finite-dimensional Hilbert space of the $n$ physical qubits of which $C(S)$ is a subspace. Denote with $C(S)^\perp$ the orthogonal complement of $C(S)$. By definition, we have
$$
\mathcal{H}=C(S)\oplus C(S)^\perp\tag1.
$$
Consider a unitary operator $U$ on $\mathcal{H}$ of the form
$$
U = U_L\oplus U_N\tag2
$$
where $U_L$ is a unitary operator on $C(S)$ and $U_N$ a unitary operator on $C(S)^\perp$. It is clear that $U_L$ is the logical operation corresponding to the action of $U$ on the physical qubits. Conversely, if $U_L$ is a logical operation on $C(S)$ then for any unitary $U_N$ acting on $C(S)^\perp$ the operator $U=U_L\oplus U_N$ acting on $\mathcal{H}$ applies the logical operation $U_L$ in the code subspace $C(S)$.
Thus, logical operations correspond to operators that can be written in the form $(2)$.
Group structure
Operators of the form $(2)$ live in the group $U(2^k)\oplus U(2^n-2^k)$. However, the correspondence between logical operations on $C(S)$ and operators of the form $(2)$ is not one-to-one as operators $U_L\oplus U_N$ and $U_L\oplus U_N'$ with $U_N\ne U_N'$ correspond to the same logical operation. Therefore, the logical operations live in
$$
\left(U(2^k) \oplus U(2^n-2^k)\right)\big/_{U(2^n-2^k)} \cong U(2^k)\tag3
$$
where we quotient out the irrelevant $U_N$. Disregarding the global phase, we see that the logical operations live in the projective unitary group on $k$ qubits
$$
\mathcal{L}(S) \cong PU(2^k).\tag4
$$
This is expected as the logical operations are quantum gates acting on $k$ qubits. Note that the physical and logical operations on a given number of qubits must possess the same group structure if logical qubits are to be used as a noise-free replacement for physical qubits. This is confirmed in $(4)$.
Matrix representation
Any basis of $C(S)$ can be extended to a basis of $\mathcal{H}$. Therefore, there exists a basis of $\mathcal{H}$
$$
|0\dots 0_L\rangle, \dots, |1\dots 1_L\rangle, |N_1\rangle, \dots, |N_{2^n-2^k}\rangle\tag5
$$
where the $2^k$ states $|0\dots 0_L\rangle$ through $|1\dots 1_L\rangle$ make up the logical computational basis and the $2^n-2^k$ states $|N_1\rangle$ through $|N_{2^n-2^k}\rangle$ help protect the logical subspace from noise. In this basis, the matrix of operators of the form $(2)$ has the following block-diagonal structure
$$
U=\begin{bmatrix}
\begin{array}{c|c}
U_L&\\
\hline
&U_N
\end{array}
\end{bmatrix}
$$
where empty blocks are filled with zeros which correspond to the fact that $U$ maps states in $C(S)$ to states in $C(S)$ and states in $C(S)^\perp$ to states in $C(S)^\perp$.
Centralizer and normalizer of $S$
Define the set of unitary operators on $\mathcal{H}$ that act as identity on $C(S)^\perp$
$$
\mathcal{A} = \{U\,|\,U = M\oplus I_{2^n-2^k}\}\tag6
$$
where $M$ acts on $C(S)$ and the identity on $C(S)^\perp$. This set is a subset of the centralizer $C_{U(2^n)}(S)$ of $S$ in $U(2^n)$.
To see this inclusion, note that by definition of $S$, for any $|\phi\rangle \in C(S)$ and any $g\in S$ we have $g|\phi\rangle = |\phi\rangle$. Since the equality holds for all $|\phi\rangle\in C(S)$ we can write $g$ in the basis $(5)$ as
$$
g = I_{2^k}\oplus g'
$$
for some $g'\in U(2^n-2^k)$. Comparing to $(6)$, we see that $g$ and $U$ commute for all $g\in S$ and all $U\in \mathcal{A}$. Thus, $\mathcal{A} \subset C_{U(2^n)}(S)$.
It is not hard to see that $\mathcal{L}(S)$ is isomorphic to $\mathcal{A}$. The isomorphism $f: \mathcal{L}(S) \to \mathcal{A}$ is defined as
$$
f(M) = M\oplus I_{2^n-2^k}
$$
where $M$ acts on $C(S)$ and the identity on $C(S)^\perp$.
Note that there are elements in $C_{U(2^n)}(S)$ that do not belong to $\mathcal{A}$. For example, $U=M\oplus g'$ for any $M\in\mathcal{L}(S)$ and any $g'\ne I$ such that $I_{2^k}\oplus g'\in S$. These are additional realizations of $M$ whose action on the irrelevant $C(S)^\perp$ is non-identity, in contrast to $M\oplus I\in\mathcal{A}$. In fact, there are operators outside of the normalizer $N_{U(2^n)}(S)$ that realize a given logical operation on $C(S)$ as the following example shows.
Example
Consider the three-qubit repetition code with logical states $|0_L\rangle=|000\rangle$ and $|1_L\rangle=|111\rangle$ and stabilizer group
$$
S = \{III, IZZ, ZIZ, ZZI\}.
$$
Note that all elements of $S$ are diagonal. Therefore, if a unitary $U$ is such that $UgU^\dagger$ is not diagonal then $U$ does not belong to the normalizer $N_{U(2^n)}(S)$ of $S$ in $U(2^n)$.
Consider the operator $W$ defined as
$$
W=\begin{bmatrix}
& & & & & & & 1 \\
& 1 & & & & & & \\
& & 1 & & & & & \\
& & & 1 & & & & \\
& & & & \frac{1}{\sqrt2} & \frac{1}{\sqrt2} & & \\
& & & & \frac{1}{\sqrt2} & -\frac{1}{\sqrt2} & & \\
& & & & & & 1 & \\
1 & & & & & & & \\
\end{bmatrix}.
$$
Clearly $W$ is unitary and realizes logical $X$ on the code subspace $C(S)=\mathrm{span}(|000\rangle, |111\rangle)$. Note that the restriction $W^\perp$ of $W$ to $C(S)^\perp$ can be written as
$$
W^\perp = I_3 \oplus H \oplus I_1
$$
and the restriction $IZZ^\perp$ of $IZZ$ to $C(S)^\perp$ can be written as
$$
\begin{align}
IZZ^\perp &= \mathrm{diag}(-1, -1, 1, 1, -1, -1) \\
&= (-I_1) \oplus (-Z) \oplus Z \oplus (-I_1).
\end{align}
$$
Therefore
$$
W^\perp\circ IZZ^\perp \circ {W^\perp}^\dagger= (-I_1) \oplus (-Z) \oplus X \oplus (-I_1)
$$
and
$$
\begin{align}
W\circ IZZ \circ W^\dagger
&= Z \oplus (-Z) \oplus X \oplus (-Z) \\
&=\begin{bmatrix}
1 & & & & & & & \\
& -1 & & & & & & \\
& & -1 & & & & & \\
& & & 1 & & & & \\
& & & & 0 & 1 & & \\
& & & & 1 & 0 & & \\
& & & & & & -1 & \\
& & & & & & & 1 \\
\end{bmatrix}
\end{align}
$$
and thus $W\notin N_{U(2^n)}(S)$.
Cardinality
From $(4)$, we see that $\mathcal{L}(S)$ is infinite.
On the other hand, $N_G(S)\subset G$ and the $n$-qubit Pauli group $G$ are finite. Similarly, $S$ is finite, so the automorphism group $\mathrm{Aut}(S)$ of $S$ and its subset the outer automorphism group $\mathrm{Out}(S)$ are both finite. See for example this question.
We conclude that
$$
\begin{align}
\mathcal{L}(S)&\ne \mathrm{Aut}(S)\\
\mathcal{L}(S)&\ne \mathrm{Out}(S)\\
\mathcal{L}(S)&\ne N_G(S)-S
\end{align}
$$
which rules out the characterizations of $\mathcal{L}(S)$ proposed in the other two answers.
Normalizer in $G$
The elements of $N_G(S)-S$ are indeed logical operations. However, since the set is a subset of the $n$-qubit Pauli group it only contains a small subset of logical operations. Namely, those that take the form of $n$-qubit Pauli operators.
Automorphism group
The idea that the automorphism group of $S$ gives the structure of the group of logical operators is wrong because most states in $C(S)$ are not stabilizer states$^1$. Consequently, transformations of the stabilizer group are insufficient to describe the logical operators acting on $C(S)$.
$^1$ Stabilizer states are defined as states stabilized by $2^n$ Pauli operators. Most states in $C(S)$ are stabilized by exactly $2^k < 2^n$ Pauli operators.